United States Senate 

WASHINGTON, DC 20510 


May 9, 2019 


The Honorable Joseph Simons 
Chairman 

Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 

The Honorable Robit Chopra 
Commissioner 
Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 

The Honorable Christine Wilson 
Commissioner 
Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 


The Honorable Noah Phillips 
Commissioner 
Federal 'Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 

The Honorable Rebecea Slaughter 
Commissioner 
Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington. DC 20580 


Dear Chairman Simons, Commissioner Phillips, Commissioner Chopra, Commissioner 
Slaughter, and Commissioner Wilson; 

We write regarding Amazon’s “Echo Dot Kids Edition” — an internet-connected “smart 
speaker” intended for children under age 13— and potential children’s privacy violations arising 
from its use. 

Voice recognition technology and artificial intelligence tools such as the Echo Dot Kids Edition 
have the potential to enrich and educate kids, including through music and storytelling. But these 
devices also present significant privacy concerns. The Echo Dot Kids Edition captures not only 
the voice recordings of the children who speak to it, but also vast amounts ol their personal 
information. Although the Echo Dot Kids Edition is subject to the Children’s Online Privacy 
Protection Act (COPPA), new evidence suggests it (1) does not meet COPPA’s notice standard; 
(2) fails to comply with the Act’s parental consent requirement, and (3) does not allow parents to 
delete their children’s private information. We address each of these potential statutory 
violations below. 
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First, under COPPA. online entities such as Amazon must provide direct notice to parents — and 
obtain verifiable parental consent, with limited exceptions — before collecting personal 
information online from children. This notice must include specific details about what type of 
information is collected, how that information is used and what is shared with third parties. 
However, while the direct notice message on Amazon’s “Parental Consent” screen describes the 
types of data the Echo Dot Kids Edition may collect, it does not provide a detailed list of the 
types of data the device actually collects. 

Additionally, the parental notice accompanying the Echo Dot Kids Edition does not appear to 
disclose to parents Amazon’s use of children's data and the extent to which Amazon shares it 
with third parties. Amazon’s “Children’s Privacy Disclosure” does not detail how the device 
shares information, and it is not clear which portions of Amazon’s general and lengthy “Privacy 
Notice” apply to data sharing through the Echo Dot Kids Edition. Researchers were unable to 
identify the data Amazon shares with “skills” — Amazon’s word for “apps” available through 
the Echo Dot Kids Edition — of which nearly 85% listed in the Amazon Alexa store do not even 
have a privacy policy. 1 2 

Second, Amazon’s mechanism for obtaining parental consent for the Echo Dot Kids Edition’s 
collection of children’s data appears to be insufficient under COPPA. According to the law, an 
operator’s consent processes must be reasonably designed, using available technology, to 
Confirm that the individual giving consent is the user’s parent. However, the Echo Dot Kids 
Edition’s method of obtaining consent for the collection of children’s personal information 
evidently fails to ensure that the individual providing the consent is indeed the user’s parent. 

Under FTC rules, one way an operator can ensure a parent is providing consent is through a 
financial transaction that will alert the primary account holder. But Amazon does not specify that 
the account holder must be die parent of the child user. A review of Amazon’s system reveals 
that it prompts the person creating the account to simply "j v[erify you’re an adult” (not 
necessarily the parent). Additionally, new research suggests that children can easily “verify 
[they’re] adults’’ by providing the card numbers of debit gift cards that anyone, regardless of age, 
can purchase." 

Finally, new evidence shows that, when parents direct Amazon to delete their children’ s 

information,; Amazon does not fully comply with this request. COPPA requires device operators 
to provide parents with access to their children’s personal information so that they can review it 
and have it deleted. But a review of the Echo Dot Kids Edition shows: that when parents have 
asked Amazon to delete recordings of their children, Amazon has kept information gleaned from 
those recordings. 3 

For example, researchers have documented instances in which the Echo Dot Kids Edition 
recorded a child speaking about her health information and address. The child’s parent then 
followed Amazon’s process for requesting deletion of the information communicated in the 


1 Request for Investigation of Amazon, Inc: 's Echo Dot Kids Edition for Violating the Children’s Online Privacy 
Protection Act, Submitted to the Federal Trade Commission by the Institute for Public Representation at 
Georgetown Law on:behalf of Campaign for a Commercial-Free Childhood (CCFC) and Center for Digital 
Democracy (CDD). (May 9, 2019). 

2 Id. at32. 

3 !d, at 38. 
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recording. But it appears that the device nonetheless "remembered" or retained the information 
in question. Researchers attempted to completely erase the child's information from the device, 
but could not identify a method for doing so that would not preclude the child from using the 
device in a meaningful way. 4 

All the preceding raises serious concerns about the extent to which the Echo Dot Kids Edition 
complies with COPPA’s requirements for parental notice, consent, and the ability to delete 
information. Children are a uniquely vulnerable population. We urge the Commission to take all 
necessary steps to ensure their privacy as “Internet of Things" devices targeting young 
consumers come to market, including promptly initiating an investigation into the Amazon Echo 
Dot Kids Edition’s compliance with COP PA. 


Sincerely, 


Edward J. Markey ^ 

United States Senator 

Richard Blumenthal 
United States Senator 





Cfc 


RicMrtTJ. Durbin 
United States Senator 
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